Data Processing Agreement (DPA)

§ 1 Parties, subject matter and term

(1) This agreement is made between the organizer for whom a workspace has been set up on TickySmart (controller under Art. 4(7) GDPR, “Customer”) and CaterSmart GmbH, Hauptstraße 41, 95482 Gefrees, Germany, which operates TickySmart (processor, “TickySmart” or “we”).

(2) It covers the processing of personal data that takes place on the Customer’s behalf when TickySmart is used: ticket shop and widget, dashboard, scan app and app, the interfaces (API, webhooks, MCP), sending order confirmations, tickets and invoices, and every other feature the Customer uses. Purpose, nature of processing, types of data and data subjects are listed in Annex 1.

(3) The agreement is part of the TickySmart user agreement (Terms) and is concluded together with it when a workspace is set up, separately for each workspace. It remains in force for as long as we process the Customer’s data, including after the user agreement ends, until the data is fully deleted under § 12.

(4) If this agreement and the user agreement conflict, this agreement prevails in matters of data protection.

(5) Where the Swiss Federal Act on Data Protection (FADP) or the UK GDPR applies to the Customer, this agreement applies accordingly. References to the GDPR then mean the corresponding provisions of those laws.

§ 2 What this agreement does not cover

(1) Some data we process as controller ourselves: the Customer’s contract and billing data, the user accounts of the Customer’s team including sign-in and security (password, two-factor sign-in, sessions), support for the Customer, and visits to our website and help center. How we handle this is described in our privacy policy.

(2) If the Customer connects TickySmart to services it has its own contract with, data goes there at the Customer’s instigation. These services are not subprocessors of TickySmart. This applies in particular to:

• Payment providers such as Stripe, Mollie or PayPal whose account the Customer connects. Buyers enter card and account details directly with the payment provider.
• Tracking and advertising services such as Meta, Google or TikTok that the Customer sets up in its shop. They only load with the buyer’s consent.
• Webhook endpoints and programs that access the workspace with one of the Customer’s API keys.
• AI assistants such as ChatGPT or Claude that the Customer connects to its workspace through the MCP access.

The Customer is responsible for choosing these services, its contract with them and informing its buyers.

§ 3 Instructions

(1) We process the data only on the Customer’s documented instructions. The instructions follow from this agreement, the user agreement and the way the Customer configures and uses TickySmart: every setting and every action in the dashboard, in the app or through the interfaces counts as an instruction.

(2) The Customer gives further instructions in text form, for example by email to support@tickysmart.io. It confirms oral instructions promptly in text form. If an instruction requires a new feature or considerably more effort than agreed, we carry it out by arrangement.

(3) If we consider an instruction unlawful, we tell the Customer without undue delay. We may suspend it until the Customer confirms or changes it.

(4) If EU or member state law requires us to process data, for example under an order from an authority, we tell the Customer beforehand unless the law prohibits this.

(5) We do not use the data for our own purposes. We do not sell it, do not contact buyers for our own marketing, do not combine data across the shops of different customers and do not train AI with it. We use figures without personal reference, such as the number of tickets sold, for billing and operations.

(6) If the data held by us is put at risk by seizure, confiscation, insolvency proceedings or other measures by third parties, we inform the Customer without undue delay and point out to those involved that the data belongs to the Customer.

§ 4 Confidentiality

(1) Only people who are bound to confidentiality or subject to a statutory duty of secrecy and who have been familiarised with data protection work with the data at our company. This obligation continues after their work ends.

(2) Our staff access the Customer’s data only where this is needed for operations, maintenance, security, fixing errors or a request from the Customer.

(3) We are currently not required to appoint a data protection officer. The contact for data protection is the management of CaterSmart GmbH, reachable at support@tickysmart.io. If we appoint a data protection officer later, they will be named here.

§ 5 Security of processing

(1) We take the technical and organizational measures under Art. 32 GDPR described in Annex 3 (Technical and organizational measures). They form part of this agreement.

(2) We develop the measures further in line with the state of the art and may replace them with equivalent or better ones. The level of protection does not decrease. We document material changes and update Annex 3.

(3) We keep a record of processing activities under Art. 30(2) GDPR.

§ 6 Supporting the Customer

(1) Requests from data subjects for access, rectification, erasure, restriction, data portability or objection are answered by the Customer as controller. TickySmart gives the Customer the tools for this: in the dashboard it can view and export a buyer’s data, anonymise the person and set retention periods after which buyer data is anonymised automatically. Anything that cannot be done this way we handle on the Customer’s instruction.

(2) If a data subject contacts us directly, we forward the request to the Customer without undue delay and name the Customer as the contact. We only answer it ourselves on the Customer’s instruction.

(3) We support the Customer with its obligations under Art. 32 to 36 GDPR, that is security of processing, notification of data breaches, data protection impact assessments and prior consultation of the supervisory authority. For this we provide the information available to us.

(4) Support through the features of TickySmart is included in the price. If a single request needs considerable extra effort, such as a search in backups, we agree the effort with the Customer beforehand and may charge for it reasonably, unless the cause lies with us.

§ 7 Data breaches

(1) If we become aware of a personal data breach affecting the Customer’s data, we inform the Customer without undue delay and no later than 48 hours. The notice is sent by email to the team members with the Owner role.

(2) As far as known, the notice states what happened, which types of data and roughly how many people and records are affected, the likely consequences, what we are doing about it and who our contact person is. Whatever we do not know yet we provide as soon as we know it.

(3) We immediately take the measures needed to secure the data and reduce harm to the people affected, and agree further steps with the Customer.

(4) The Customer decides whether the supervisory authority and the people affected are notified (Art. 33 and 34 GDPR). We support the Customer in this. We only notify the people affected on the Customer’s instruction.

(5) A notice under this section is not an admission of fault.

§ 8 Subprocessors

(1) The Customer authorises us to use the subprocessors listed in Annex 2 (general authorisation under Art. 28(2) GDPR).

(2) Before we add or replace a subprocessor, we inform the Customer by email at least 30 days in advance and update Annex 2. The Customer may object in text form within this period if it has an important reason under data protection law. If we cannot find a solution, the Customer may terminate the user agreement for cause with effect from the date of the change. Until the period has expired, no Customer data goes to the new service. If the Customer does not object, the change is deemed approved.

(3) If a service has to be replaced at short notice because of an outage or a security issue, we may shorten the period. We then inform the Customer without undue delay; its right to object remains.

(4) We choose every subprocessor carefully, including on the basis of its security measures. We bind it by contract to the same data protection obligations that this agreement places on us and check this regularly. We are liable to the Customer for it as for our own conduct (Art. 28(4) GDPR).

(5) Purely ancillary services such as telecommunications and transport services are not subprocessing.

§ 9 Place of processing

(1) The data is stored in data centers in Germany. We run servers, database, files and backups with Hetzner Online GmbH.

(2) Data only goes to a country outside the EU and the European Economic Area if the requirements of Art. 44 et seq. GDPR are met: with an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework for certified companies), with EU standard contractual clauses or another appropriate safeguard. Annex 2 shows which services this concerns.

§ 10 Audits

(1) The Customer may check whether we comply with this agreement. We answer its questions, provide the necessary information and, on request, present evidence such as certificates of the data centers.

(2) If that is not sufficient, the Customer may carry out an on-site audit itself or have it carried out by an auditor bound to confidentiality who is not our competitor. The Customer announces it with reasonable notice, usually at least two weeks in advance. The audit takes place during our business hours, does not disrupt operations unnecessarily and protects the confidentiality of other customers’ data. For the data centers of our service providers, their rules and evidence apply.

(3) Each party bears its own costs. If the Customer requests more than one on-site audit per year without a specific reason, we may charge reasonably for our effort.

(4) The powers of the supervisory authorities remain unaffected. We cooperate with them and inform the Customer about audits and requests that concern its data, as far as we are allowed to.

§ 11 Customer obligations

(1) The Customer ensures that it is allowed to process the data. This includes the legal basis, informing buyers (for example in its privacy policy in the shop), consent for tracking and marketing, and appropriate retention periods.

(2) The Customer protects access to its workspace, assigns roles only as far as needed and removes access when team members or devices no longer need it. We recommend two-factor sign-in for all accounts.

(3) The Customer is responsible for data it imports itself, such as guest lists or data from a previous ticketing system.

(4) If the Customer notices errors or irregularities in the processing, it tells us without undue delay.

§ 12 Deletion and return

(1) During the term, the Customer can export its data from the dashboard at any time. TickySmart anonymises buyer data according to the retention periods the Customer sets.

(2) If the Customer deletes its workspace, it is deleted with all its data after a waiting period of 24 hours. Until then the Customer can undo the deletion. If the user agreement ends in another way, we delete the Customer’s data no later than 30 days after the end of the agreement. Before that, the Customer can export it.

(3) Deleted data disappears from backups as they expire, after 30 days at the latest. Until then we only use backups to restore operations after an outage.

(4) Statutory retention obligations that apply to us remain unaffected. Invoices and records the Customer must keep for its own accounting are exported by the Customer before deletion.

(5) On request we confirm the deletion with its date in text form. We have no right of retention to the data.

§ 13 Liability

Liability is governed by the user agreement. Liability towards data subjects under Art. 82 GDPR remains unaffected.

§ 14 Final provisions

(1) If we need to change this agreement because the law or TickySmart changes, we inform the Customer of the changes by email at least 30 days before they take effect. If the Customer does not object within this period, they are deemed agreed; we point this out in the notice. If the Customer objects, the previous version continues to apply and either party may terminate the user agreement in accordance with its terms. § 8 applies to Annex 2 and § 5(2) to Annex 3.

(2) Text form, such as an email, is sufficient for declarations under this agreement. The agreement exists in electronic form (Art. 28(9) GDPR). Anyone who needs a signed copy can get one as a PDF on request.

(3) If a provision is invalid, the rest of the agreement remains valid. It is replaced by a provision that complies with Art. 28 GDPR and comes closest to what was intended.

(4) German law applies. Jurisdiction follows the user agreement.

(5) The German version of this agreement is binding. The English translation is for information only.

Annex 1: Purpose, data and data subjects

Purpose of processing

TickySmart is software for selling tickets and running events. On the Customer’s behalf, we process data to:

• sell tickets, extras and gift vouchers in the Customer’s shop, handle orders, reconcile payments with the Customer’s payment provider and carry out refunds
• send order confirmations, tickets, wallet passes, invoices and other messages to buyers
• control entry, scan tickets and keep guest lists
• provide the waiting room, waitlist, seating plan, time slots and season tickets
• show the Customer orders, customer profiles and statistics, including through statistics links it shares with partners
• pass data to systems the Customer connects (API, webhooks, exports)
• run AI features that the Customer or its team calls up
• support the Customer, fix errors and back up data

Nature of processing: collection, recording, organisation, storage, adaptation, retrieval, consultation, use, disclosure by transmission, alignment, restriction, anonymisation and erasure (Art. 4(2) GDPR).

Data subjects

• Buyers and customers in the Customer’s shop, including invoice recipients
• Ticket holders whose name is on a ticket
• Guests on guest lists, people on waitlists and in the waiting room
• Recipients of gift vouchers
• The Customer’s team members and people who scan tickets for the Customer
• Contacts at the Customer’s partners, ticket outlets and sponsors
• Artists and performers the Customer names in the line-up
• Other people whose data the Customer brings in through imports, the interfaces or free text

Types of data

• Contact data: first and last name, email address, for invoices also company, address and VAT number
• Order data: order number, time, tickets, seats, extras, prices, taxes, fees, discount codes, gift vouchers, refunds, language and the accepted terms
• Payment data: payment method, status and the payment’s reference at the payment provider. TickySmart does not store card or account details.
• Ticket data: ticket code, signed QR code, name on the ticket, date, area and validity
• Entry data: time and result of scans, entrance and device; for entry without a connection also a copy of the ticket list on the Customer's entry devices (ticket code, ticket type, name on the ticket, order number, previous scans) until the device or the account is signed out
• Communication data: messages sent and their delivery status
• Consent and origin: consent for tracking and marketing, the partner link or campaign an order came from
• Technical data: IP address, browser and timestamps where needed for security, abuse prevention and troubleshooting, device identifiers for updating wallet passes and identifiers of entry devices
• Team data: name, email address, role, assigned events and logged changes (audit log)
• Artist data: name, photo, short biography and links

TickySmart checks age limits without a date of birth: the buyer only confirms that they are old enough.

Special categories of personal data (Art. 9 GDPR), such as health data, are not intended. If the Customer asks for such information, for example for wheelchair spaces, it ensures there is a legal basis.

Annex 2: Subprocessors

As of 26 October 2026. We announce new or replaced subprocessors under § 8.

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany
  Data centers: servers, database, files and backups
  Location: Germany
• Mailgun Technologies, Inc., USA
  Sending emails such as order confirmations, tickets and notifications
  Location: Mailgun’s EU region; access from the USA is possible and safeguarded by EU standard contractual clauses
• OpenAI Ireland Ltd, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, Ireland
  AI features (writing and translating texts, reviewing events, event from poster, importing a website or ticket shop, chat assistant), only when the Customer uses them; data is not used for training
  Location: processing in the USA possible, safeguarded by EU standard contractual clauses and the EU-US Data Privacy Framework
• Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA
  AI features as with OpenAI, when we use a model from Anthropic for them; data is not used for training
  Location: USA, safeguarded by EU standard contractual clauses
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
  Google Wallet, only when a buyer saves their ticket there (event, date, ticket type, name on the ticket, QR code)
  Location: EU, processing in the USA possible, safeguarded by EU standard contractual clauses and the EU-US Data Privacy Framework
• Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland
  Apple Push Notification service: a notice to the device when a ticket in Apple Wallet changes (device identifier only, no ticket content)
  Location: EU, processing in the USA possible, safeguarded by EU standard contractual clauses and the EU-US Data Privacy Framework

Services the Customer connects itself (§ 2(2)) are not subprocessors. For artist info, we query public directories such as MusicBrainz and Wikipedia with the artist’s name only; no buyer data leaves TickySmart in the process. For updates of the TickySmart app we use EAS Update by Expo (650 Industries, Inc., USA); only the IP address, platform, app version and a random identifier of the installation leave TickySmart, no buyer data.

Annex 3: Technical and organizational measures

The measures are on a separate page: Technical and organizational measures (TOMs).